{
 "id": "WPSEC-2026-2724",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2724/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2724/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2724/index.md",
 "title": "Falang multilanguage for WordPress <= 1.4.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Language Order Modification via AJAX Actions",
 "description": "The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data via several AJAX actions, including falang_option_translation, falang_post_translation and falang_language_ordering, in all versions up to, and including, 1.4.6, due to missing capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the value of arbitrary scalar site options (which may hold credentials or API keys), view the content of any post including private and draft posts, and change the order of the site's languages.",
 "plugin": {
  "slug": "falang",
  "name": "Falang multilanguage for WordPress",
  "full_name": "Falang multilanguage for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/falang/",
  "advisories_url": "https://wpsec.com/vuln/plugin/falang/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/falang"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.7",
 "remediation": "Update to 1.4.7 or later.",
 "fix_released": "2026-11-06T16:32:19+00:00",
 "published": "2026-11-07T16:41:22+00:00",
 "updated": "2026-11-07T11:11:31.522978+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2724/",
  "https://plugins.svn.wordpress.org/falang/tags/1.4.7/",
  "https://wordpress.org/plugins/falang/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/falang",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}